CVE-2026-57843
MediumCVSS 5.5Summary
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures.
Risk Assessment
A local attacker can obtain kernel address information, facilitating further attacks such as ASLR bypass and privilege escalation.
Recommendation
Upgrade NetBSD to a version that fixes the incorrect setting of the PK_KMEM flag for world-accessible devices.
Other vulnerabilities in NetBSD
See all- CVE-2026-57842High
NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX.
- CVE-2017-1000374Critical
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
- CVE-2026-32849Medium
NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.
- CVE-2026-32848Medium
NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.
- CVE-1999-0764Medium
NetBSD allows ARP packets to overwrite static ARP entries.
- CVE-1999-0763Medium
NetBSD on multi-homed hosts allows ARP packets from one network to modify ARP entries on another connected network.
- CVE-1999-0422Medium
In some cases, mount in NetBSD 1.3.3 allows local users to execute programs in file systems that have the 'noexec' flag set.
Original NVD description (English source)
NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries.